Method of detecting anomalies in a communication system using symbolic packet features

Abstract

A method of detecting anomalies in a communication system includes: providing a first packet flow portion and a second packet flow portion; extracting samples of a symbolic packet feature associated with a traffic status of the first and second packet flow portions; computing from the extracted samples a first statistical concentration quantity and a second statistical concentration quantity of the symbolic feature associated with the first and second packet flow portions, respectively; computing from the concentration quantities a variation quantity representing a concentration change from the first packet flow portion to the second packet flow portion; comparing the variation quantity with a comparison value; and detecting an anomaly in the system in response to the comparison.

Description

BACKGROUND[0001]1. Technical Field[0002]The present invention relates to anomaly detection on packet switched communication systems. Particularly, the present invention is related to statistical methods for detecting network traffic anomalies due to network attacks or to communication system failures.[0003]2. Description of the Related Art[0004]Several types of attacks are known, such as: (distributed) denial of service ((D)DoS) attacks, scanning attacks, SPAM or SPIT attacks, and malicious software attacks.[0005]Denial-of-Service (DoS) attacks and, in particular, distributed DoS (DDoS) attacks are commonly regarded as a major threat to the Internet. A DoS attack is an attack on a computer system or network that causes a loss of service or network connectivity to legitimate users, that is, unavailability of services. Most common DoS attacks aim at exhausting the computational resources, such as connection bandwidth, memory space, or CPU time, for example, by flooding a target networ...

AI Technical Summary

Benefits of technology

[0021]The Applicant has noticed that there is a need in the field for achieving an anomaly detection method providing increased reliability and, preferably, reduced computational complexity and memory requirements. In accordance with a particular embodiment, the Applicant has observed that advantages can be obtained by monitoring the statistical behavior of symbolic packet features associated with two packet flow portions lying in corresponding time windows that are moving in time.

Problems solved by technology

The Applicant has observed that the known solutions are not satisfactory with respect to the achieved false-negative and false-positive rates and the computational complexity and memory requirements.

This could be due to the fact that it is difficult for the normal traffic in communications networks to be described by stable probability distributions.

Moreover, it is difficult to define statistical models of communication systems that would give rise to sufficiently low false-positive and false-negative rates.

It should be also noticed that the complexity of the proposed statistical methods may be unacceptably high for high-speed and high-volume communications networks.

Images